How you'd know your domain is being spoofed

A customer calls about an invoice. Different bank details, slightly odd wording, and they've already paid it. It came from your domain, or close enough that nobody looked twice.

Nothing warned you. There is no alert for this. The receiving mail servers of the world know your domain is being forged before you do, and unless you've asked them to tell you, they won't.

The three ways people actually find out

Someone tells you. A customer, a supplier, or your own staff forwards you a message that looks wrong. By this point the campaign has been running for days and you're doing damage control rather than prevention.

Backscatter. Bounce messages start arriving for mail you never sent — hundreds of "user unknown" replies from domains you've never contacted. That's the failed portion of a spoofing run coming home to the address in the envelope, which is you.

DMARC reports. The only one of the three that arrives before the damage. Publish a rua= address and receivers send you daily XML summaries of every source sending under your domain, whether it passed, and what they did about it. That is the detection mechanism. Everything else is a customer complaint with extra steps.

If you take one thing from this: a domain with no rua= address is a domain where you have deliberately chosen not to be told.

What DMARC stops, and what it doesn't

Be precise about the boundary here, because a lot of vendors are not.

DMARC at p=reject stops exact-domain forgery — mail where the From header says billing@yourcompany.com and the sender can't prove it. That's the highest-value attack and it's the one that gets shut off completely. Worth doing.

It does nothing about two other things.

It does not stop display-name spoofing. Anyone can open a free mailbox and set their display name to your owner's full name. The From address is randomstring@gmail.com, so DMARC has no claim on it — your domain was never used. On a phone, the recipient sees the name and not the address.

It does not stop lookalike domains. yourcompany-billing.com, yourcornpany.com, yourcompany.co. Those are somebody else's domains, correctly authenticated, with their own perfectly valid SPF and DKIM. A DMARC record on your domain cannot reach them.

So the honest split is: DMARC removes one attack entirely and leaves two that are handled by staff training, payment-change verification procedures, and occasionally registering the obvious typo domains yourself.

The posture almost nobody applies

Here's the part that gets skipped. When people harden email, they harden the domain they send from. They stop there.

Most businesses own more than one domain. The old name from before the rebrand. The .net and the .org bought defensively. The typo variants. The domain for a product line that never launched. All of them are parked, none of them send mail, and none of them have a single protective record. Every one of those is a free, credible-looking sending identity for anyone who notices — and attackers do notice, because a domain registered to your business with no DMARC record is a better lure than a Gmail address.

A domain that will never send mail should say so explicitly, in three records:

example.com.          IN TXT "v=spf1 -all"
_dmarc.example.com.   IN TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@yourrealdomain.com"
example.com.          IN MX  0 .

Read them in order. v=spf1 -all says no host on earth is authorized to send for this domain — a hard fail, not the ~all softfail you'd use on a live sending domain. p=reject with sp=reject tells receivers to throw away anything claiming to be from it, subdomains included. And MX 0 . — a single dot as the exchange, which is the null MX from RFC 7505 — says the domain accepts no mail at all, so senders fail immediately instead of queueing for days against a host that isn't there.

Three records, no cost, no maintenance, and the domain becomes useless to a forger. The rua= still points somewhere you read, so if anyone does try, you find out. I set this on every client domain that isn't a live mail domain, and it takes about two minutes each.

The same logic applies inside a domain you do send from. If mail never comes from mail.yourcompany.com or vpn.yourcompany.com, your published subdomain policy should say so rather than leaving the whole namespace under your name unclaimed.

What to do

List every domain your business owns. Not the ones you use — the ones you own. Check the registrar, not your memory.
For each, decide: does this send mail, ever, including from a form on a website? If no, publish the three null records above.
On your real sending domain, get a rua= address in place today even if you leave the policy at p=none. Detection first, enforcement second.
Write down a rule for payment changes that does not involve email — a phone call to a number you already had. That's the only control that covers the lookalike and display-name cases.

None of this stops someone from typing your company's name into a free mailbox. It does mean that when they try to do it with your actual domain, the message never reaches anyone, and you get told they tried.

If you'd rather have someone lock down every domain you own and set up the reporting properly, say what you're dealing with here.